Misc fixes for 1031ee6.

policy/modules/kernel/files.if

@@ -1502,24 +1502,6 @@ interface(`files_dontaudit_getattr_boot_dirs',`
 	dontaudit $1 boot_t:dir getattr;
 ')
 
-########################################
-## <summary>
-##	List the /boot directory.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`files_list_boot',`
-	gen_require(`
-		type boot_t;
-	')
-
-	allow $1 boot_t:dir list_dir_perms;
-')
-
 ########################################
 ## <summary>
 ##	Search the /boot directory.
@@ -1556,6 +1538,24 @@ interface(`files_dontaudit_search_boot',`
 	dontaudit $1 boot_t:dir search_dir_perms;
 ')
 
+########################################
+## <summary>
+##	List the /boot directory.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_list_boot',`
+	gen_require(`
+		type boot_t;
+	')
+
+	allow $1 boot_t:dir list_dir_perms;
+')
+
 ########################################
 ## <summary>
 ##	Create directories in /boot

policy/modules/services/apache.if

@@ -773,7 +773,6 @@ interface(`apache_list_sys_content',`
 	')
 
 	list_dirs_pattern($1, httpd_sys_content_t, httpd_sys_content_t)
-	read_lnk_files_pattern($1, httpd_sys_content_t, httpd_sys_content_t)
 	files_search_var($1)
 ')
 

policy/modules/services/apache.te

@@ -451,7 +451,7 @@ optional_policy(`
 ')
 
 optional_policy(`
-	cobbler_search_var_lib(httpd_t)
+	cobbler_search_lib(httpd_t)
 ')
 
 optional_policy(`

policy/modules/services/bind.if

@@ -6,11 +6,10 @@
 ## </summary>
 ## <param name="domain">
 ##	<summary>
-##	The type of the process performing this action.
+##	Domain allowed access.
 ##	</summary>
 ## </param>
 #
-#
 interface(`bind_initrc_domtrans',`
 	gen_require(`
 		type named_initrc_exec_t;
@@ -209,25 +208,6 @@ interface(`bind_manage_config_dirs',`
 	manage_dirs_pattern($1, named_conf_t, named_conf_t)
 ')
 
-########################################
-## <summary>
-##	Manage BIND zone files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`bind_manage_zone',`
-	gen_require(`
-		type named_zone_t;
-	')
-
-	files_search_var($1)
-	manage_files_pattern($1, named_zone_t, named_zone_t)
-')
-
 ########################################
 ## <summary>
 ##	Search the BIND cache directory.
@@ -309,6 +289,25 @@ interface(`bind_read_zone',`
 	read_files_pattern($1, named_zone_t, named_zone_t)
 ')
 
+########################################
+## <summary>
+##	Manage BIND zone files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`bind_manage_zone',`
+	gen_require(`
+		type named_zone_t;
+	')
+
+	files_search_var($1)
+	manage_files_pattern($1, named_zone_t, named_zone_t)
+')
+
 ########################################
 ## <summary>
 ##	Send and receive datagrams to and from named.  (Deprecated)

policy/modules/services/cobbler.fc

@@ -1,7 +1,7 @@
-/etc/cobbler(/.*)?								gen_context(system_u:object_r:cobbler_etc_t, s0)
+/etc/cobbler(/.*)?		gen_context(system_u:object_r:cobbler_etc_t, s0)
-/etc/rc\.d/init\.d/cobblerd				--		gen_context(system_u:object_r:cobblerd_initrc_exec_t, s0)
+/etc/rc\.d/init\.d/cobblerd --	gen_context(system_u:object_r:cobblerd_initrc_exec_t, s0)
 
-/usr/bin/cobblerd						--		gen_context(system_u:object_r:cobblerd_exec_t, s0)
+/usr/bin/cobblerd	--	gen_context(system_u:object_r:cobblerd_exec_t, s0)
 
-/var/lib/cobbler(/.*)?							gen_context(system_u:object_r:cobbler_var_lib_t, s0)
+/var/lib/cobbler(/.*)?		gen_context(system_u:object_r:cobbler_var_lib_t, s0)
-/var/log/cobbler(/.*)?							gen_context(system_u:object_r:cobbler_var_log_t, s0)
+/var/log/cobbler(/.*)?		gen_context(system_u:object_r:cobbler_var_log_t, s0)

policy/modules/services/cobbler.if

@@ -10,6 +10,42 @@
 ##	</p>
 ## </desc>
 
+########################################
+## <summary>
+##	Execute a domain transition to run cobblerd.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed to transition.
+## </summary>
+## </param>
+#
+interface(`cobblerd_domtrans',`
+	gen_require(`
+		type cobblerd_t, cobblerd_exec_t;
+	')
+
+	domtrans_pattern($1, cobblerd_exec_t, cobblerd_t)
+')
+
+########################################
+## <summary>
+##	Execute cobblerd server in the cobblerd domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	The type of the process performing this action.
+##	</summary>
+## </param>
+#
+interface(`cobblerd_initrc_domtrans',`
+	gen_require(`
+		type cobblerd_initrc_exec_t;
+	')
+
+	init_labeled_script_domtrans($1, cobblerd_initrc_exec_t)
+')
+
 ########################################
 ## <summary>
 ##	Read Cobbler content in /etc
@@ -48,6 +84,25 @@ interface(`cobbler_dontaudit_rw_log',`
 	dontaudit $1 cobbler_var_log_t:file rw_file_perms;
 ')
 
+########################################
+## <summary>
+##	Search cobbler dirs in /var/lib
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`cobbler_search_lib',`
+	gen_require(`
+		type cobbler_var_lib_t;
+	')
+
+	search_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
+	files_search_var_lib($1)
+')
+
 ########################################
 ## <summary>
 ##	Read cobbler files in /var/lib
@@ -58,7 +113,7 @@ interface(`cobbler_dontaudit_rw_log',`
 ##	</summary>
 ## </param>
 #
-interface(`cobbler_read_var_lib_files',`
+interface(`cobbler_read_lib_files',`
 	gen_require(`
 		type cobbler_var_lib_t;
 	')
@@ -77,7 +132,7 @@ interface(`cobbler_read_var_lib_files',`
 ##	</summary>
 ## </param>
 #
-interface(`cobbler_manage_var_lib_files',`
+interface(`cobbler_manage_lib_files',`
 	gen_require(`
 		type cobbler_var_lib_t;
 	')
@@ -86,61 +141,6 @@ interface(`cobbler_manage_var_lib_files',`
 	files_search_var_lib($1)
 ')
 
-########################################
-## <summary>
-##	Search cobbler dirs in /var/lib
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`cobbler_search_var_lib',`
-	gen_require(`
-		type cobbler_var_lib_t;
-	')
-
-	search_dirs_pattern($1, cobbler_var_lib_t, cobbler_var_lib_t)
-	files_search_var_lib($1)
-')
-
-########################################
-## <summary>
-##	Execute a domain transition to run cobblerd.
-## </summary>
-## <param name="domain">
-## <summary>
-##	Domain allowed to transition.
-## </summary>
-## </param>
-#
-interface(`cobblerd_domtrans',`
-	gen_require(`
-		type cobblerd_t, cobblerd_exec_t;
-	')
-
-	domtrans_pattern($1, cobblerd_exec_t, cobblerd_t)
-')
-
-########################################
-## <summary>
-##	Execute cobblerd server in the cobblerd domain.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	The type of the process performing this action.
-##	</summary>
-## </param>
-#
-interface(`cobblerd_initrc_domtrans',`
-	gen_require(`
-		type cobblerd_initrc_exec_t;
-	')
-
-	init_labeled_script_domtrans($1, cobblerd_initrc_exec_t)
-')
-
 ########################################
 ## <summary>
 ##	All of the rules required to administrate 

policy/modules/services/cobbler.te

@@ -52,6 +52,8 @@ read_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
 setattr_files_pattern(cobblerd_t, cobbler_var_log_t, cobbler_var_log_t)
 logging_log_filetrans(cobblerd_t, cobbler_var_log_t, file)
 
+kernel_read_system_state(cobblerd_t)
+
 corecmd_exec_bin(cobblerd_t)
 corecmd_exec_shell(cobblerd_t)
 
@@ -67,13 +69,9 @@ corenet_tcp_sendrecv_generic_port(cobblerd_t)
 dev_read_urand(cobblerd_t)
 
 files_read_usr_files(cobblerd_t)
-
 files_list_boot(cobblerd_t)
-
 files_list_tmp(cobblerd_t)
 
-kernel_read_system_state(cobblerd_t)
-
 miscfiles_read_localization(cobblerd_t)
 miscfiles_read_public_files(cobblerd_t)
 
@@ -119,6 +117,5 @@ optional_policy(`
 ')
 
 optional_policy(`
-	tftp_manage_tftpdir_dirs(cobblerd_t)
+	tftp_manage_rw_content(cobblerd_t)
-	tftp_manage_tftpdir_files(cobblerd_t)
 ')

policy/modules/services/dnsmasq.fc

@@ -1,4 +1,4 @@
-/etc/dnsmasq\.conf			--	gen_context(system_u:object_r:dnsmasq_etc_t, s0)
+/etc/dnsmasq\.conf		--	gen_context(system_u:object_r:dnsmasq_etc_t, s0)
 /etc/rc\.d/init\.d/dnsmasq	--	gen_context(system_u:object_r:dnsmasq_initrc_exec_t,s0)
 
 /usr/sbin/dnsmasq		--	gen_context(system_u:object_r:dnsmasq_exec_t,s0)

policy/modules/services/dnsmasq.if

@@ -96,6 +96,44 @@ interface(`dnsmasq_kill',`
 	allow $1 dnsmasq_t:process sigkill;
 ')
 
+########################################
+## <summary>
+##	Read dnsmasq config files.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed.
+## </summary>
+## </param>
+#
+interface(`dnsmasq_read_config',`
+	gen_require(`
+		type dnsmasq_etc_t;
+	')
+
+	allow $1 dnsmasq_etc_t:file read_file_perms;
+	files_search_etc($1)
+')
+
+########################################
+## <summary>
+##	Write to dnsmasq config files.
+## </summary>
+## <param name="domain">
+## <summary>
+##	Domain allowed.
+## </summary>
+## </param>
+#
+interface(`dnsmasq_write_config',`
+	gen_require(`
+		type dnsmasq_etc_t;
+	')
+
+	allow $1 dnsmasq_etc_t:file write_file_perms;
+	files_search_etc($1)
+')
+
 ########################################
 ## <summary>
 ##	Delete dnsmasq pid files
@@ -134,44 +172,6 @@ interface(`dnsmasq_read_pid_files',`
 	read_files_pattern($1, dnsmasq_var_run_t, dnsmasq_var_run_t)
 ')
 
-########################################
-## <summary>
-##	Read dnsmasq config files.
-## </summary>
-## <param name="domain">
-## <summary>
-##	Domain allowed.
-## </summary>
-## </param>
-#
-interface(`dnsmasq_read_config',`
-	gen_require(`
-		type dnsmasq_etc_t;
-	')
-
-	read_files_pattern($1, dnsmasq_etc_t, dnsmasq_etc_t)
-	files_search_etc($1)
-')
-
-########################################
-## <summary>
-##	Write to dnsmasq config files.
-## </summary>
-## <param name="domain">
-## <summary>
-##	Domain allowed.
-## </summary>
-## </param>
-#
-interface(`dnsmasq_write_config',`
-	gen_require(`
-		type dnsmasq_etc_t;
-	')
-
-	write_files_pattern($1, dnsmasq_etc_t, dnsmasq_etc_t)
-	files_search_etc($1)
-')
-
 ########################################
 ## <summary>
 ##	All of the rules required to administrate 

policy/modules/services/dnsmasq.te

@@ -37,7 +37,7 @@ allow dnsmasq_t self:udp_socket create_socket_perms;
 allow dnsmasq_t self:packet_socket create_socket_perms;
 allow dnsmasq_t self:rawip_socket create_socket_perms;
 
-read_files_pattern(dnsmasq_t, dnsmasq_etc_t, dnsmasq_etc_t)
+allow dnsmasq_t dnsmasq_etc_t:file read_file_perms;
 
 # dhcp leases
 manage_files_pattern(dnsmasq_t, dnsmasq_lease_t, dnsmasq_lease_t)
@@ -71,6 +71,7 @@ dev_read_urand(dnsmasq_t)
 
 domain_use_interactive_fds(dnsmasq_t)
 
+files_read_etc_files(dnsmasq_t)
 files_read_etc_runtime_files(dnsmasq_t)
 
 fs_getattr_all_fs(dnsmasq_t)

policy/modules/services/rsync.if

@@ -119,7 +119,7 @@ interface(`rsync_read_config',`
 		type rsync_etc_t;
 	')
 
-	read_files_pattern($1, rsync_etc_t, rsync_etc_t)
+	allow $1 rsync_etc_t:file read_file_perms;
 	files_search_etc($1)
 ')
 
@@ -138,6 +138,6 @@ interface(`rsync_write_config',`
 		type rsync_etc_t;
 	')
 
-	write_files_pattern($1, rsync_etc_t, rsync_etc_t)
+	allow $1 rsync_etc_t:file read_file_perms;
 	files_search_etc($1)
 ')

policy/modules/services/rsync.te

@@ -60,7 +60,7 @@ allow rsync_t self:udp_socket connected_socket_perms;
 allow rsync_t self:netlink_tcpdiag_socket r_netlink_socket_perms;
 #end for identd
 
-read_files_pattern(rsync_t, rsync_etc_t, rsync_etc_t)
+allow rsync_t rsync_etc_t:file read_file_perms;
 
 allow rsync_t rsync_data_t:dir list_dir_perms;
 read_files_pattern(rsync_t, rsync_data_t, rsync_data_t)

policy/modules/services/tftp.if

@@ -1,43 +1,5 @@
 ## <summary>Trivial file transfer protocol daemon</summary>
 
-########################################
-## <summary>
-##	Manage tftp /var/lib files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`tftp_manage_tftpdir_dirs',`
-	gen_require(`
-		type tftpdir_rw_t;
-	')
-
-	files_search_var_lib($1)
-	manage_dirs_pattern($1, tftpdir_rw_t, tftpdir_rw_t)
-')
-
-########################################
-## <summary>
-##	Manage tftp /var/lib files.
-## </summary>
-## <param name="domain">
-##	<summary>
-##	Domain allowed access.
-##	</summary>
-## </param>
-#
-interface(`tftp_manage_tftpdir_files',`
-	gen_require(`
-		type tftpdir_rw_t;
-	')
-
-	files_search_var_lib($1)
-	manage_files_pattern($1, tftpdir_rw_t, tftpdir_rw_t)
-')
-
 ########################################
 ## <summary>
 ##	Read tftp content
@@ -56,6 +18,26 @@ interface(`tftp_read_content',`
 	read_files_pattern($1, tftpdir_t, tftpdir_t)
 ')
 
+########################################
+## <summary>
+##	Manage tftp /var/lib files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`tftp_manage_rw_content',`
+	gen_require(`
+		type tftpdir_rw_t;
+	')
+
+	files_search_var_lib($1)
+	manage_dirs_pattern($1, tftpdir_rw_t, tftpdir_rw_t)
+	manage_files_pattern($1, tftpdir_rw_t, tftpdir_rw_t)
+')
+
 ########################################
 ## <summary>
 ##	All of the rules required to administrate

policy/modules/system/miscfiles.fc

@@ -74,8 +74,8 @@ ifdef(`distro_redhat',`
 /var/cache/fonts(/.*)?		gen_context(system_u:object_r:tetex_data_t,s0)
 /var/cache/man(/.*)?		gen_context(system_u:object_r:man_t,s0)
 
-/var/www/cobbler/images(/.*)?				gen_context(system_u:object_r:public_content_rw_t, s0)
+/var/www/cobbler/images(/.*)?	gen_context(system_u:object_r:public_content_rw_t, s0)
-/var/lib/cobbler/webui_sessions(/.*)?		gen_context(system_u:object_r:public_content_rw_t, s0)
+/var/lib/cobbler/webui_sessions(/.*)? gen_context(system_u:object_r:public_content_rw_t, s0)
 
 /var/spool/texmf(/.*)?		gen_context(system_u:object_r:tetex_data_t,s0)
 

policy/modules/system/sysnetwork.fc

@@ -12,7 +12,7 @@
 /etc/dhcpc.*			gen_context(system_u:object_r:dhcp_etc_t,s0)
 /etc/dhcpd\.conf	--	gen_context(system_u:object_r:dhcp_etc_t,s0)
 /etc/dhcp/dhcpd\.conf	--	gen_context(system_u:object_r:dhcp_etc_t,s0)
-/etc/ethers			--	gen_context(system_u:object_r:net_conf_t,s0)
+/etc/ethers		--	gen_context(system_u:object_r:net_conf_t,s0)
 /etc/resolv\.conf.*	--	gen_context(system_u:object_r:net_conf_t,s0)
 /etc/yp\.conf.*		--	gen_context(system_u:object_r:net_conf_t,s0)